1 /* 2 * Copyright (C) 2020 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #pragma once 18 19 /* This file is separate because it's included both by eBPF programs (via include 20 * in bpf_helpers.h) and directly by the boot time bpfloader (Loader.cpp). 21 */ 22 23 #include <linux/bpf.h> 24 25 // Pull in AID_* constants from //system/core/libcutils/include/private/android_filesystem_config.h 26 #include <cutils/android_filesystem_config.h> 27 28 /****************************************************************************** 29 * * 30 * ! ! ! W A R N I N G ! ! ! * 31 * * 32 * CHANGES TO THESE STRUCTURE DEFINITIONS OUTSIDE OF AOSP/MAIN *WILL* BREAK * 33 * MAINLINE MODULE COMPATIBILITY * 34 * * 35 * AND THUS MAY RESULT IN YOUR DEVICE BRICKING AT SOME ARBITRARY POINT IN * 36 * THE FUTURE * 37 * * 38 * (and even in aosp/master you may only append new fields at the very end, * 39 * you may *never* delete fields, change their types, ordering, insert in * 40 * the middle, etc. If a mainline module using the old definition has * 41 * already shipped (which happens roughly monthly), then it's set in stone) * 42 * * 43 ******************************************************************************/ 44 45 /* 46 * The bpf_{map,prog}_def structures are compiled for different architectures. 47 * Once by the BPF compiler for the BPF architecture, and once by a C++ 48 * compiler for the native Android architecture for the bpfloader. 49 * 50 * For things to work, their layout must be the same between the two. 51 * The BPF architecture is platform independent ('64-bit LSB bpf'). 52 * So this effectively means these structures must be the same layout 53 * on 5 architectures, all of them little endian: 54 * 64-bit BPF, x86_64, arm and 32-bit x86 and arm 55 * 56 * As such for any types we use inside of these structs we must make sure that 57 * the size and alignment are the same, so the same amount of padding is used. 58 * 59 * Currently we only use: bool, enum bpf_map_type and unsigned int. 60 * Additionally we use char for padding. 61 * 62 * !!! WARNING: HERE BE DRAGONS !!! 63 * 64 * Be particularly careful with 64-bit integers. 65 * You will need to manually override their alignment to 8 bytes. 66 * 67 * To quote some parts of https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69560 68 * 69 * Some types have weaker alignment requirements when they are structure members. 70 * 71 * unsigned long long on x86 is such a type. 72 * 73 * C distinguishes C11 _Alignof (the minimum alignment the type is guaranteed 74 * to have in all contexts, so 4, see min_align_of_type) from GNU C __alignof 75 * (the normal alignment of the type, so 8). 76 * 77 * alignof / _Alignof == minimum alignment required by target ABI 78 * __alignof / __alignof__ == preferred alignment 79 * 80 * When in a struct, apparently the minimum alignment is used. 81 */ 82 83 _Static_assert(sizeof(bool) == 1, "sizeof bool != 1"); 84 _Static_assert(__alignof__(bool) == 1, "__alignof__ bool != 1"); 85 _Static_assert(_Alignof(bool) == 1, "_Alignof bool != 1"); 86 87 _Static_assert(sizeof(char) == 1, "sizeof char != 1"); 88 _Static_assert(__alignof__(char) == 1, "__alignof__ char != 1"); 89 _Static_assert(_Alignof(char) == 1, "_Alignof char != 1"); 90 91 // This basically verifies that an enum is 'just' a 32-bit int 92 _Static_assert(sizeof(enum bpf_map_type) == 4, "sizeof enum bpf_map_type != 4"); 93 _Static_assert(__alignof__(enum bpf_map_type) == 4, "__alignof__ enum bpf_map_type != 4"); 94 _Static_assert(_Alignof(enum bpf_map_type) == 4, "_Alignof enum bpf_map_type != 4"); 95 96 // Linux kernel requires sizeof(int) == 4, sizeof(void*) == sizeof(long), sizeof(long long) == 8 97 _Static_assert(sizeof(unsigned int) == 4, "sizeof unsigned int != 4"); 98 _Static_assert(__alignof__(unsigned int) == 4, "__alignof__ unsigned int != 4"); 99 _Static_assert(_Alignof(unsigned int) == 4, "_Alignof unsigned int != 4"); 100 101 // We don't currently use any 64-bit types in these structs, so this is purely to document issue. 102 // Here sizeof & __alignof__ are consistent, but _Alignof is not: compile for 'aosp_cf_x86_phone' 103 _Static_assert(sizeof(unsigned long long) == 8, "sizeof unsigned long long != 8"); 104 _Static_assert(__alignof__(unsigned long long) == 8, "__alignof__ unsigned long long != 8"); 105 // BPF wants 8, but 32-bit x86 wants 4 106 //_Static_assert(_Alignof(unsigned long long) == 8, "_Alignof unsigned long long != 8"); 107 108 109 // for maps: 110 struct shared_bool { bool shared; }; 111 #define PRIVATE ((struct shared_bool){ .shared = false }) 112 #define SHARED ((struct shared_bool){ .shared = true }) 113 114 // for programs: 115 struct optional_bool { bool optional; }; 116 #define MANDATORY ((struct optional_bool){ .optional = false }) 117 #define OPTIONAL ((struct optional_bool){ .optional = true }) 118 119 // for both maps and programs: 120 struct ignore_on_eng_bool { bool ignore_on_eng; }; 121 #define LOAD_ON_ENG ((struct ignore_on_eng_bool){ .ignore_on_eng = false }) 122 #define IGNORE_ON_ENG ((struct ignore_on_eng_bool){ .ignore_on_eng = true }) 123 124 struct ignore_on_user_bool { bool ignore_on_user; }; 125 #define LOAD_ON_USER ((struct ignore_on_user_bool){ .ignore_on_user = false }) 126 #define IGNORE_ON_USER ((struct ignore_on_user_bool){ .ignore_on_user = true }) 127 128 struct ignore_on_userdebug_bool { bool ignore_on_userdebug; }; 129 #define LOAD_ON_USERDEBUG ((struct ignore_on_userdebug_bool){ .ignore_on_userdebug = false }) 130 #define IGNORE_ON_USERDEBUG ((struct ignore_on_userdebug_bool){ .ignore_on_userdebug = true }) 131 132 133 // Length of strings (incl. selinux_context and pin_subdir) 134 // in the bpf_map_def and bpf_prog_def structs. 135 // 136 // WARNING: YOU CANNOT *EVER* CHANGE THESE 137 // as this would affect the structure size in backwards incompatible ways 138 // and break mainline module loading on older Android T devices 139 #define BPF_SELINUX_CONTEXT_CHAR_ARRAY_SIZE 32 140 #define BPF_PIN_SUBDIR_CHAR_ARRAY_SIZE 32 141 142 /* 143 * Map structure to be used by Android eBPF C programs. The Android eBPF loader 144 * uses this structure from eBPF object to create maps at boot time. 145 * 146 * The eBPF C program should define structure in the maps section using 147 * SECTION("maps") otherwise it will be ignored by the eBPF loader. 148 * 149 * For example: 150 * const struct bpf_map_def SECTION("maps") mymap { .type=... , .key_size=... } 151 * 152 * See 'bpf_helpers.h' for helpful macros for eBPF program use. 153 */ 154 struct bpf_map_def { 155 enum bpf_map_type type; 156 unsigned int key_size; 157 unsigned int value_size; 158 unsigned int max_entries; 159 unsigned int map_flags; 160 161 // The following are not supported by the Android bpfloader: 162 // unsigned int inner_map_idx; 163 // unsigned int numa_node; 164 165 unsigned int zero; // uid_t, for compat with old (buggy) bpfloader must be AID_ROOT == 0 166 unsigned int gid; // gid_t 167 unsigned int mode; // mode_t 168 169 // The following fields were added in version 0.1 170 unsigned int bpfloader_min_ver; // if missing, defaults to 0, ie. v0.0 171 unsigned int bpfloader_max_ver; // if missing, defaults to 0x10000, ie. v1.0 172 173 // The following fields were added in version 0.2 (S) 174 // kernelVersion() must be >= min_kver and < max_kver 175 unsigned int min_kver; 176 unsigned int max_kver; 177 178 // The following fields were added in version 0.18 (T) 179 // 180 // These are fixed length strings, padded with null bytes 181 // 182 // Warning: supported values depend on .o location 183 // (additionally a newer Android OS and/or bpfloader may support more values) 184 // 185 // overrides default selinux context (which is based on pin subdir) 186 char selinux_context[BPF_SELINUX_CONTEXT_CHAR_ARRAY_SIZE]; 187 // 188 // overrides default prefix (which is based on .o location) 189 char pin_subdir[BPF_PIN_SUBDIR_CHAR_ARRAY_SIZE]; 190 191 bool shared; // use empty string as 'file' component of pin path - allows cross .o map sharing 192 193 // The following 3 ignore_on_* fields were added in version 0.32 (U). These are ignored in 194 // older bpfloader versions, and zero in programs compiled before 0.32. 195 bool ignore_on_eng:1; 196 bool ignore_on_user:1; 197 bool ignore_on_userdebug:1; 198 // The following 5 ignore_on_* fields were added in version 0.38 (U). These are ignored in 199 // older bpfloader versions, and zero in programs compiled before 0.38. 200 // These are tests on the kernel architecture, ie. they ignore userspace bit-ness. 201 bool ignore_on_arm32:1; 202 bool ignore_on_aarch64:1; 203 bool ignore_on_x86_32:1; 204 bool ignore_on_x86_64:1; 205 bool ignore_on_riscv64:1; 206 207 char pad0[2]; // manually pad up to 4 byte alignment, may be used for extensions in the future 208 209 unsigned int uid; // uid_t 210 }; 211 212 _Static_assert(sizeof(((struct bpf_map_def *)0)->selinux_context) == 32, "must be 32 bytes"); 213 _Static_assert(sizeof(((struct bpf_map_def *)0)->pin_subdir) == 32, "must be 32 bytes"); 214 215 // This needs to be updated whenever the above structure definition is expanded. 216 _Static_assert(sizeof(struct bpf_map_def) == 120, "sizeof struct bpf_map_def != 120"); 217 _Static_assert(__alignof__(struct bpf_map_def) == 4, "__alignof__ struct bpf_map_def != 4"); 218 _Static_assert(_Alignof(struct bpf_map_def) == 4, "_Alignof struct bpf_map_def != 4"); 219 220 struct bpf_prog_def { 221 unsigned int uid; 222 unsigned int gid; 223 224 // kernelVersion() must be >= min_kver and < max_kver 225 unsigned int min_kver; 226 unsigned int max_kver; 227 228 bool optional; // program section (ie. function) may fail to load, continue onto next func. 229 230 // The following 3 ignore_on_* fields were added in version 0.33 (U). These are ignored in 231 // older bpfloader versions, and zero in programs compiled before 0.33. 232 bool ignore_on_eng:1; 233 bool ignore_on_user:1; 234 bool ignore_on_userdebug:1; 235 // The following 5 ignore_on_* fields were added in version 0.38 (U). These are ignored in 236 // older bpfloader versions, and zero in programs compiled before 0.38. 237 // These are tests on the kernel architecture, ie. they ignore userspace bit-ness. 238 bool ignore_on_arm32:1; 239 bool ignore_on_aarch64:1; 240 bool ignore_on_x86_32:1; 241 bool ignore_on_x86_64:1; 242 bool ignore_on_riscv64:1; 243 244 char pad0[2]; // manually pad up to 4 byte alignment, may be used for extensions in the future 245 246 // The following fields were added in version 0.1 247 unsigned int bpfloader_min_ver; // if missing, defaults to 0, ie. v0.0 248 unsigned int bpfloader_max_ver; // if missing, defaults to 0x10000, ie. v1.0 249 250 // The following fields were added in version 0.18, see description up above in bpf_map_def 251 char selinux_context[BPF_SELINUX_CONTEXT_CHAR_ARRAY_SIZE]; 252 char pin_subdir[BPF_PIN_SUBDIR_CHAR_ARRAY_SIZE]; 253 }; 254 255 _Static_assert(sizeof(((struct bpf_prog_def *)0)->selinux_context) == 32, "must be 32 bytes"); 256 _Static_assert(sizeof(((struct bpf_prog_def *)0)->pin_subdir) == 32, "must be 32 bytes"); 257 258 // This needs to be updated whenever the above structure definition is expanded. 259 _Static_assert(sizeof(struct bpf_prog_def) == 92, "sizeof struct bpf_prog_def != 92"); 260 _Static_assert(__alignof__(struct bpf_prog_def) == 4, "__alignof__ struct bpf_prog_def != 4"); 261 _Static_assert(_Alignof(struct bpf_prog_def) == 4, "_Alignof struct bpf_prog_def != 4"); 262